05000499/LER-2003-003

LER-2003-003, Standby Diesel Generator 22 Failure

South Texas Unit 2
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
4992003003R01 - NRC Website

I. � DESCRIPTION OF EVENT

A. REPORTABLE EVENT CLASSIFICATION

This event is reportable pursuant to 10CFR50.73(a)(2)(i)(B). The South Texas Project has determined, based on metallurgical analysis of the failed parts, that Standby Diesel Generator 22 was inoperable for an undetermined period of time and could not have satisfied Technical Specification requirements for operability in the times specified under Technical Specification 3.8.1.1, Action b.

B. PLANT OPERATING CONDITIONS PRIOR TO EVENT

South Texas Project Unit 2 was in Mode 1 operating at 100% power.

THE START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT

Standby Diesel Generator 22 was the only component affected by this event.

D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES

On December 9, 2003, an operability test of Standby Diesel Generator 22 was performed in accordance with surveillance procedures. Standby Diesel Generator 22 was started at 0942 and initially loaded at 0947. The generator load was increased to 25% at 0950, 50% at 1000, 75% at 1010, and 100% at 1020. At 1038, the 9R master connecting rod and associated parts failed. The engine continued to run until the fuel racks were manually closed approximately six minutes later.

At the time of the engine failure, the Plant Operator monitoring the diesel locally was taking the first set of diesel logs as directed by the surveillance procedure. The Plant Operator was standing at the northwest corner of the engine recording the crankcase differential pressure reading when a loud noise came from the engine. The local Plant Operator immediately left the diesel engine area and returned to the local control panel area where multiple alarms were indicated. At the same time that the noise occurred, the Main Control Room received a diesel trouble alarm. The licensed operator in the Main Control Room observed indication of no electrical load and no engine oil pressure for Standby Diesel Generator 22. The Main Control Room Operator put the diesel control switch in "Pull-To-Stop," but the engine continued to run.

The local Plant Operator notified the Main Control Room of the alarms, that no oil or jacket water pressure was indicated, and that the diesel was still running at approximately 600 rpm. The local Plant Operator was instructed by the Main Control Room to locally push the two emergency stop buttons. The buttons were pushed immediately, but the diesel engine continued to run. A second licensed Operator left the Main Control Room and went to the Standby Diesel Generator 22 bay to aid in tripping the diesel engine locally. The local Plant Operator and he both tried the emergency stop push buttons, again with no response, and then went to the remote trip location for the air intake butterfly valve. The licensed Operator was unable to trip the air intake butterfly valve at the overspeed governor. Seeing some of the engine damage and significant amounts of smoke-like oil fumes in the area, the licensed Operator directed the local Plant Operator to leave the area for safety reasons. The local Plant Operator then went to the fuel oil storage tank room and closed the fuel isolation valve to the engine. The licensed Operator returned to the butterfly remote trip to try again to isolate it. At about the same time, a second licensed Operator and several other Plant Operators entered the diesel area. The second licensed Operator concurred 05000 499

2. DOCKET

2003 � 03 � 01 with the arriving Plant Operators that the fuel racks needed to be closed. The engine was stopped at approximately 1044 by manually closing the fuel racks. The air intake butterfly valve was then successfully closed at the valve.

At about the same time the engine was stopped, the second licensed Operator recommended to the Shift Supervisor in the Main Control Room that the fire brigade be called out. The Fire Brigade was dispatched at 1044 under the procedure for Fire/Explosion. When the fire brigade arrived at Standby Diesel Generator 22, no smoke or flames were found, but there was a significant amount of fuel/lubrication oil fumes in the air and oil on the floor which could have posed a fire hazard. At 1048, the Fire Brigade confirmed that no flames were present. After a short period with maximum ventilation, the Fire Brigade Leader notified the Main Control Room that there was no fire. The Fire/Explosion procedure was exited at 1112.

See Attachment 1 for a diagram showing the master and articulated rods.

Damage Assessment and Investigation Following the incident, the Standby Diesel Generator 22 room was cordoned off and access was controlled to protect the integrity of fractured surfaces for future metallurgical analysis. Pictures were taken of the damaged diesel and the ejected components on the floor prior to anything being moved or touched. All Operations personnel on duty and involved in the incident were interviewed and data collected before the end of shift.

Initial examination of the engine revealed destruction of the 9-Right (9R) and 9-Left (9L) cylinders and corresponding moving parts. Portions of the engine center frame with several major components were ejected out of the right (east) side of the engine. The ejected parts included:

• The 9L articulated rod,

• The 9R piston,

• A piece of the end of the position 9 master rod that attaches to the articulated rod and crankshaft,

• A crankshaft counterweight,

• A center frame inspection door, and

• Pieces of the center frame itself.

The 9L piston crown was lodged in its cylinder. The major part of the position 9 master rod and other parts and debris were found in the crankcase.

Shutdown air is needed to trip the diesel engine from the Main Control Room switch and from the local emergency stop pushbuttons. However, ejected parts severely damaged the diesel control air and shutdown air lines, which is why the trip attempts from those two stations were unsuccessful. When the Operators attempted to trip the air intake butterfly valve at the overspeed governor, the plunger could not be pulled out. The reason why the butterfly valve could not be tripped will be addressed as part of replacing the damaged turbocharger.

The crack initiated on the master connecting rod in the area (ligament) between the crankshaft bearing bore and the articulating rod bushing bore. The crack propagated through the section thickness (approximately I") and then propagated across the width of the bore. One side of the 4 fracture essentially extended across the width of the fracture face with only a small corner section showing overload. The other side of the fracture extended approximately 3.5" angled toward the articulating rod bushing surface, followed by failure due to overload.

Visible "beach marks", which indicate that a crack was propagated by cyclic stresses, were found on a fracture surface on the position 9 master rod at the common ligament area between the master rod crankshaft bearing bore and the articulated rod pin bore. The articulated rod, a piece of the master rod, and several other damaged pieces were sent to a metallurgical lab for analysis. Lab results confirmed that there was a high cycle fatigue crack on the master connecting rod.

Inertial loads as the master rod piston approaches top dead center on the exhaust stroke cause the peak tensile stress in the vicinity of the fracture. Fatigue cracking is propagated by tensile stresses. Since the firing stroke imposes compressive stresses, it does not cause fatigue cracking. Because of this, the stress in the region of the fracture is independent of engine load and crack propagation is related only to the number of master rod piston exhaust strokes.

Summary of Root Cause The root cause of the diesel engine failure was microcracks created on the position 9 master connecting rod during the manufacturing process. The microcracks propagated due to high cycle fatigue until the master connecting rod failed.

The crack began in a region of microcracks at the surface of the master rod bearing bore. The crack initiation area was at the bottom of a small indentation made after the master rod failure (the area was struck during the failure). The indentation was a smooth, high energy impact zone with directional lines, and partially overlapped the fracture surface. The surface features in the bottom of the indentation and next to the indentation at the fracture surface were examined and the indentation was found to not be the stress riser that initiated the crack. The surface features in both areas are comparable. Both areas exhibit surface microcracking. The microcracking orientation is parallel to the failure fracture surface.

Based on the Scanning Electron Microscope inspection of the high cycle fatigue crack initiation site and based on inspection of the upper connecting rod bearing shell, there is no evidence of foreign material entrapped between the bearing shell and the connecting rod crankshaft bearing bore. There is also no evidence of fretting fatigue, large inclusions, or foreign material at the crack initiation site. The crack actually initiated from two sites. The two crack fronts grew together over a short distance, indicating they were very close in proximity and very similar in initiation time (simultaneous).

The ligament sees alternating stresses and these stresses allowed the microcracks to slowly propagate through the master rod until critical crack size was reached. The surface features and microcracking are consistent with damage produced during manufacture (such as from tool chatter) followed by the honing that is normally done as part of the manufacturing process. The force required to produce the microcracks would only be seen during machining operations.

No human performance issues were noted with respect to this event.

2003 � 03 � 01

PROCEDURAL ERROR

This condition was identified during a routine surveillance test of Standby Diesel Generator 22.

II. EVENT-DRIVEN INFORMATION

A. SAFETY SYSTEMS THAT RESPONDED

The failure of Standby Diesel Generator 22 caused no other safety systems to start or change state.

B. DURATION OF SAFETY SYSTEM INOPERABILITY

Technical Specification action 3.8.1.1.b requires that an inoperable standby diesel generator be returned to operable status within 14 days or be in at least hot shutdown within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in cold shutdown within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Considering the extent of damage done to Standby Diesel Generator 22 and supporting equipment, the South Texas Project anticipated that shutdown of Unit 2 would be required under the Technical Specifications as written.

Consequently, an emergency Technical Specification change was proposed to the NRC to increase the allowed outage time to 113 days, allowing Unit 2 to continue operation until the next scheduled refueling outage while Standby Diesel Generator 22 is repaired. The request used both deterministic and probabilistic arguments in support of this one-time change. NRC approval of the increase in allowed outage time was given on December 30, 2003.

C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT

The Onsite Standby Power Supply Systems of Units 1 and 2 each consist of three independent, physically separated, standby diesel generators supplying power to three associated load groups designated Train A, Train B, and Train C. Each load group consists of a 4.16 kV ESF bus and the electrical loads connected to that bus. The Onsite Standby Power Supply Systems of Units 1 and 2 operate independently of each other. Each standby diesel generator and load group of a particular unit is also physically separated and electrically independent from the other two standby diesel generators and their load groups. Each train (i.e., Load Group) is independent but is not totally redundant; two trains are necessary to mitigate the consequences of a design basis accident.

The South Texas Project has verified that no potential for a common-mode failure due to this failure mechanism was present.

The plant retains a substantial capability to mitigate design basis events with the reduced capability resulting from the inoperable diesel.

A single operable ESF train can mitigate (at a reduced capacity in certain cases) the design basis accidents except for a large break LOCA where the break is located in the RCS loop associated with the operating train of safety injection.

When assessing the safety consequences of the diesel failure, a twenty-four hour mission time was assumed for the diesel generator. The accident analysis assumes the diesel generator operates following a loss of offsite power until offsite power is restored. There is a high likelihood of restoring power within six hours based on the history of the Texas power grid; therefore, a value of twenty-four hours is considered conservative for power restoration. Although STPNOC does not have firm evidence of when the diesel failure mechanism progressed to the point where the mission time could not be satisfied, a date of November 10, 2003 was assumed for risk evaluation purposes. This date corresponds to the satisfactory completion of a SDG 22 24-hour surveillance test run. The risk evaluation determined that the incremental change in core damage probability for the 29-day period from November 10, 2003 until December 9, 2003 was approximately 3.3E-06.

The current average core damage frequency for the South Texas Project is 9.08E-06/year and the current large early release frequency is 5.18E-07/year.

III. CAUSE OF THE EVENT

The root cause of the diesel engine failure was microcracks created on the position 9 master connecting rod during the manufacturing process. The microcracks propagated due to high cycle fatigue until the master connecting rod failed.

IV. CORRECTIVE ACTIONS

1. Repair Standby Diesel Generator 22 and associated damaged equipment.

and Unit 2 has been completed. Similar areas of cracking have not been found.

V. PREVIOUS SIMILAR EVENTS

Failures of Cooper Bessemer KSV diesel engine connecting rods have occurred at other nuclear facilities, as well as at the South Texas Project. However, no other failures have occurred for the same reason as this event. Similar connecting rod failures have occurred in non-nuclear applications and in non-KSV engines resulting from high cycle fatigue. In some instances, poor machining quality was suspected.

VI. ADDITIONAL INFORMATION

Visual examination of the bearing bores of the ten master connecting rods from Standby Diesel Generator 22 identified some areas of surface disturbance on the bore surfaces. These were generally small areas, 1/8" to 5/16" across, with a roughened appearance. Fluorescent magnetic particle technique (MT) examination of these features in mid-January, 2004, found small crack-like linear indications within the boundaries of a subset of these features.

Metallurgical and metallographic evidence shows that the small anomalies seen in the nine non- ejected connecting rods from SDG 22 are consequences of the incident. They do not represent conditions present in the connecting rods prior to the fracture of master connecting rod #9.

Accordingly, there is no reason to suspect that similar features are present in the connecting rods in the other Cooper-Bessemer KSV-20 standby diesels at STP.

Articulated Rod Master Rod

• 11

• .0.

• .1 Site of crack initiation (on the master rod under the bearing shell) Attachment 1 Diagram of Connecting Rods 1.

2.

3.

4.

Piston Pin Oil Passage Dowel (3) Washer (4) 13.

14.

15.

16.

Bearing Shell, Top Dowel (2) Bed Cap Lccknut (4) ., Bolt Lock (4) 17. Stud (4) 6. Pin Bolt (4) 18. Bearing Shell Bottom 7. Drake Nut (4) 19. Art. Rod Pin 8. Bolt Luck (2) 20. Rod Pin Bolt 9. Washer (2) 21. Bearing Cap (Nut O. Oil Passage. Tightening Sequence) 11. Bushing 22. Washer 12. Dowel Pin (4)